Trojan.DownLoader13.3017

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Installer Hardware Name Task' = 'C:\lhmzbnybwsdb\ezgczfq.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Policy Network Adapter Secure Fax Center] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'C:\lhmzbnybwsdb\txqlxgxmnue.exe' "c:\lhmzbnybwsdb\ezgczfq.exe"
'C:\lhmzbnybwsdb\ezgczfq.exe'
'C:\lhmzbnybwsdb\uivz2newj3ziqptu.exe'

Modifies file system :

Creates the following files:

C:\lhmzbnybwsdb\ezgczfq.exe
C:\lhmzbnybwsdb\txqlxgxmnue.exe
C:\lhmzbnybwsdb\lx9xz7xnt
%WINDIR%\lhmzbnybwsdb\lkxjkqg
C:\lhmzbnybwsdb\lkxjkqg
C:\lhmzbnybwsdb\uivz2newj3ziqptu.exe

Sets the 'hidden' attribute to the following files:

C:\lhmzbnybwsdb\txqlxgxmnue.exe
C:\lhmzbnybwsdb\ezgczfq.exe

Deletes the following files:

C:\lhmzbnybwsdb\uivz2newj3ziqptu.exe
%WINDIR%\lhmzbnybwsdb\lkxjkqg

Network activity:

Connects to:

'pr####twomen.net':80
'ch###clean.net':80
'pr####tcourse.net':80
'th###women.net':80
'co####epaint.net':80
'ch###course.net':80
'co####eclean.net':80
'ch###paint.net':80
'se####different.net':80
'th###clean.net':80
'se####letter.net':80
'qu####ifferent.net':80
'pr####tpaint.net':80
'th###course.net':80
'pr####tclean.net':80
'th###paint.net':80
'al###women.net':80
'mi###eclean.net':80
'al###course.net':80
'of###women.net':80
'tw###epaint.net':80
'mi####course.net':80
'tw###eclean.net':80
'mi###epaint.net':80
'co####ewomen.net':80
'of###clean.net':80
'co####ecourse.net':80
'ch###women.net':80
'al###paint.net':80
'of###course.net':80
'al###clean.net':80
'of###paint.net':80
'qu###letter.net':80
'st####different.net':80
'tr####ifferent.net':80
'st####letter.net':80
'tr###letter.net':80
'be####beside.net':80
'ga####beside.net':80
'be####surprise.net':80
'ga####surprise.net':80
're####different.net':80
'el#####cdifferent.net':80
're####letter.net':80
'el####icletter.net':80
'st####beside.net':80
'tr###beside.net':80
'st####surprise.net':80
'tr####urprise.net':80
'fl####ifferent.net':80
'br####ifferent.net':80
'fl###letter.net':80
'br###letter.net':80
'qu###beside.net':80
'se####beside.net':80
'qu####urprise.net':80
'se####surprise.net':80
'be####different.net':80
'ga####different.net':80
'be####letter.net':80
'ga####letter.net':80
'fl###beside.net':80
'br###beside.net':80
'fl####urprise.net':80
'br####urprise.net':80

TCP:

HTTP GET requests:

http://pr####twomen.net/index.php?me########
http://ch###clean.net/index.php?me########
http://pr####tcourse.net/index.php?me########
http://th###women.net/index.php?me########
http://co####epaint.net/index.php?me########
http://ch###course.net/index.php?me########
http://co####eclean.net/index.php?me########
http://ch###paint.net/index.php?me########
http://se####different.net/index.php?me########
http://th###clean.net/index.php?me########
http://se####letter.net/index.php?me########
http://qu####ifferent.net/index.php?me########
http://pr####tpaint.net/index.php?me########
http://th###course.net/index.php?me########
http://pr####tclean.net/index.php?me########
http://th###paint.net/index.php?me########
http://al###women.net/index.php?me########
http://mi###eclean.net/index.php?me########
http://al###course.net/index.php?me########
http://of###women.net/index.php?me########
http://tw###epaint.net/index.php?me########
http://mi####course.net/index.php?me########
http://tw###eclean.net/index.php?me########
http://mi###epaint.net/index.php?me########
http://co####ewomen.net/index.php?me########
http://of###clean.net/index.php?me########
http://co####ecourse.net/index.php?me########
http://ch###women.net/index.php?me########
http://al###paint.net/index.php?me########
http://of###course.net/index.php?me########
http://al###clean.net/index.php?me########
http://of###paint.net/index.php?me########
http://qu###letter.net/index.php?me########
http://st####different.net/index.php?me########
http://tr####ifferent.net/index.php?me########
http://st####letter.net/index.php?me########
http://tr###letter.net/index.php?me########
http://be####beside.net/index.php?me########
http://ga####beside.net/index.php?me########
http://be####surprise.net/index.php?me########
http://ga####surprise.net/index.php?me########
http://re####different.net/index.php?me########
http://el#####cdifferent.net/index.php?me########
http://re####letter.net/index.php?me########
http://el####icletter.net/index.php?me########
http://st####beside.net/index.php?me########
http://tr###beside.net/index.php?me########
http://st####surprise.net/index.php?me########
http://tr####urprise.net/index.php?me########
http://fl####ifferent.net/index.php?me########
http://br####ifferent.net/index.php?me########
http://fl###letter.net/index.php?me########
http://br###letter.net/index.php?me########
http://qu###beside.net/index.php?me########
http://se####beside.net/index.php?me########
http://qu####urprise.net/index.php?me########
http://se####surprise.net/index.php?me########
http://be####different.net/index.php?me########
http://ga####different.net/index.php?me########
http://be####letter.net/index.php?me########
http://ga####letter.net/index.php?me########
http://fl###beside.net/index.php?me########
http://br###beside.net/index.php?me########
http://fl####urprise.net/index.php?me########
http://br####urprise.net/index.php?me########

UDP:

DNS ASK pr####twomen.net
DNS ASK ch###clean.net
DNS ASK pr####tcourse.net
DNS ASK th###women.net
DNS ASK co####epaint.net
DNS ASK ch###course.net
DNS ASK co####eclean.net
DNS ASK ch###paint.net
DNS ASK se####different.net
DNS ASK th###clean.net
DNS ASK se####letter.net
DNS ASK qu####ifferent.net
DNS ASK pr####tpaint.net
DNS ASK th###course.net
DNS ASK pr####tclean.net
DNS ASK th###paint.net
DNS ASK co####ecourse.net
DNS ASK mi###eclean.net
DNS ASK tw###eclean.net
DNS ASK of###women.net
DNS ASK al###women.net
DNS ASK mi####course.net
DNS ASK tw####course.net
DNS ASK mi###epaint.net
DNS ASK tw###epaint.net
DNS ASK of###clean.net
DNS ASK al###clean.net
DNS ASK ch###women.net
DNS ASK co####ewomen.net
DNS ASK of###course.net
DNS ASK al###course.net
DNS ASK of###paint.net
DNS ASK al###paint.net
DNS ASK st####different.net
DNS ASK tr####ifferent.net
DNS ASK st####letter.net
DNS ASK tr###letter.net
DNS ASK be####beside.net
DNS ASK ga####beside.net
DNS ASK be####surprise.net
DNS ASK ga####surprise.net
DNS ASK re####different.net
DNS ASK el#####cdifferent.net
DNS ASK re####letter.net
DNS ASK el####icletter.net
DNS ASK st####beside.net
DNS ASK tr###beside.net
DNS ASK st####surprise.net
DNS ASK tr####urprise.net
DNS ASK be####letter.net
DNS ASK br####ifferent.net
DNS ASK qu####urprise.net
DNS ASK br###letter.net
DNS ASK fl####ifferent.net
DNS ASK se####beside.net
DNS ASK qu###letter.net
DNS ASK se####surprise.net
DNS ASK qu###beside.net
DNS ASK ga####different.net
DNS ASK fl####urprise.net
DNS ASK ga####letter.net
DNS ASK be####different.net
DNS ASK br###beside.net
DNS ASK fl###letter.net
DNS ASK br####urprise.net
DNS ASK fl###beside.net

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial